Bank of America penalty exposes failures in compliance controls

Bank of America’s $1.2 billion anti-money laundering charge has intensified scrutiny of outdated compliance systems after US regulators identified extensive failures to detect and report suspicious transactions.

The penalty, disclosed alongside the bank’s third-quarter results on October 14, reduced earnings by 17 cents a share and highlighted the financial consequences of weaknesses that regulators said persisted despite earlier warnings and corrective commitments.

The bank reported quarterly net income of $6.9 billion, or 91 cents per diluted share, compared with $8.3 billion, or $1.04 a share, a year earlier. Excluding the non-tax-deductible regulatory charge, earnings were $1.08 a share.

The enforcement action announced on October 13 involved three Treasury agencies. The Financial Crimes Enforcement Network imposed a $1.2 billion penalty, while the Office of the Comptroller of the Currency assessed $750 million, credited against the FinCEN amount rather than added to it. A separate sanctions settlement totalled approximately $11.6 million.

FinCEN said the bank failed to report more than $5 billion in suspicious transactions promptly, including over $1 billion involving national security priorities and other significant illicit finance risks. Regulators identified possible connections to Chinese money laundering networks, trade-based laundering, fraud and financial activity linked to the US southwest border.

The bank admitted in its FinCEN resolution that it had wilfully violated requirements of the Bank Secrecy Act, including obligations governing compliance programmes, correspondent banking due diligence and suspicious activity reporting.

The OCC described longstanding failures in transaction monitoring, escalation procedures, staffing expertise and internal auditing. It said potentially suspicious transactions were not consistently referred to investigators, even after the bank entered a cease-and-desist order in December 2024 requiring improvements.

The findings have renewed questions about whether large banks can adequately oversee vast payment networks when compliance processes rely on fragmented data, ineffective monitoring rules and manual intervention. Such weaknesses can prevent investigators from recognising suspicious patterns across accounts and business lines, even where individual transactions appear unremarkable.

The OCC said the bank processed hundreds of trillions of dollars in transactions annually, making effective controls especially important. It also found that personnel responsible for anti-money laundering oversight lacked appropriate training and expertise, while internal audits missed problems subsequently identified by examiners.

Treasury Secretary Scott Bessent said failures at an institution of this scale exposed the wider financial system to illicit finance risks. Regulators stressed that financial institutions must identify and report warning signs rather than merely maintain formal compliance policies.

Bank of America said it had invested billions of dollars in technology and deployed thousands of employees to combat financial crime. It maintained that work to address regulatory concerns was well advanced and that it remained committed to completing required improvements.

The enforcement orders require an independent assessment of transaction monitoring, customer due diligence, correspondent account oversight and the data governance supporting those functions. The bank must also engage an outside party to review past activity and identify suspicious transactions that were previously missed.

The Office of Foreign Assets Control separately resolved 475 apparent sanctions violations involving programmes covering Russia, Iran and other designated targets. The agency attributed those lapses to problems including delayed watchlist updates, poorly calibrated alerts and human or technical errors in processing payments.

OFAC classified the apparent violations as non-egregious, although most had not been voluntarily disclosed. The settlement requires further commitments concerning training, testing, auditing and communication with the sanctions authority.

The regulatory charge coincided with softer trading results. Bank of America’s sales and trading revenue fell 5 per cent to $5.1 billion, while investment banking fees declined 11 per cent to $1.8 billion. Net interest income, however, increased as loan and deposit balances grew.

Shares fell sharply following the earnings release as investors weighed the penalty alongside weaker capital markets performance. The bank returned $8.3 billion to shareholders during the quarter through dividends and share repurchases, according to its financial disclosures.

The consent order also directs scrutiny towards risks involving Iran, Russia and potential narcotics trafficking. Its required review of data governance places attention on the quality and accessibility of information feeding surveillance tools, not simply the number of alerts those tools generate across accounts.

Its quarterly effective tax rate was approximately 23 per cent, compared with an adjusted rate of about 20 per cent excluding the regulatory charge. The settlement expense was recorded within the bank’s All Other reporting segment.